CVE-2023-53419

In the Linux kernel, the following vulnerability has been resolved:

rcu: Protect rcuprinttaskexpstall() ->exp_tasks access

For kernels built with CONFIGPREEMPTRCU=y, the following scenario can result in a NULL-pointer dereference:

       CPU1                                           CPU2

rcupreemptdeferredqsirqrestore rcuprinttaskexpstall if (special.b.blocked) READONCE(rnp->exptasks) != NULL rawspinlockrcunode np = rcunextnodeentry(t, rnp) if (&t->rcunodeentry == rnp->exptasks) WRITEONCE(rnp->exptasks, np) .... rawspinunlockirqrestorercunode rawspinlockirqsavercunode t = listentry(rnp->exptasks->prev, struct taskstruct, rcunodeentry) (if rnp->exptasks is NULL, this will dereference a NULL pointer)

The problem is that CPU2 accesses the rcunode structure's->exptasks field without holding the rcunode structure's ->lock and CPU2 did not observe CPU1's change to rcunode structure's ->exptasks in time. Therefore, if CPU1 sets rcunode structure's->exp_tasks pointer to NULL, then CPU2 might dereference that NULL pointer.

This commit therefore holds the rcunode structure's ->lock while accessing that structure's->exptasks field.

[ paulmck: Apply Frederic Weisbecker feedback. ]